diff --git a/tools/ci-publish.sh b/tools/ci-publish.sh
index bd1db9d5..6e809bc7 100755
--- a/tools/ci-publish.sh
+++ b/tools/ci-publish.sh
@@ -11,18 +11,26 @@ REMOTE="git@tangled.org:cameron.stream/misaligned"
 # tangled.org's ed25519 host key, so the push cannot be intercepted.
 HOST_KEY="tangled.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII2UShEm/FFPmYZUizaPnIqOJuynoCQpcLhl5PPHd02n"
 
+# A push to main that does not publish fails the run, so the site cannot fall
+# behind while every pipeline shows green. Pull requests and other branches
+# skip quietly. A missing kind or branch fails too: it means Tangled changed
+# the variables this reads.
 KIND="${TANGLED_PIPELINE_KIND:-}"
 REF="${TANGLED_REF_NAME:-}"
+if [ -z "$KIND" ] || { [ -z "$REF" ] && { [ "$KIND" = push ] || [ "$KIND" = manual ]; }; }; then
+  echo "publish: FAILED. TANGLED_PIPELINE_KIND ('$KIND') or TANGLED_REF_NAME ('$REF') is empty, so this cannot tell a push to main from a pull request." >&2
+  exit 1
+fi
 if { [ "$KIND" != push ] && [ "$KIND" != manual ]; } || [ "$REF" != main ]; then
-  echo "publish: only pushes to main publish (this is ${KIND:-unknown} on ${REF:-no branch})"
+  echo "publish: only pushes to main publish (this is $KIND on $REF)"
   exit 0
 fi
 REV="${TANGLED_SHA:?TANGLED_SHA is not set}"
 
 if [ -z "${DEPLOY_SSH_KEY:-}" ]; then
-  echo "publish: SKIPPED. The repository secret DEPLOY_SSH_KEY is not set, so CI cannot push to pages."
-  echo "publish: add it under Settings > Pipelines > Secrets, or run tools/deploy.sh by hand."
-  exit 0
+  echo "publish: FAILED. The repository secret DEPLOY_SSH_KEY is not set, so CI cannot push to pages and the site still shows an older build." >&2
+  echo "publish: add it under Settings > Pipelines > Secrets, or run tools/deploy.sh by hand." >&2
+  exit 1
 fi
 
 # ssh refuses to run if the current uid has no passwd entry, which nixery
@@ -45,4 +53,4 @@ status=0
 GIT_AUTHOR_NAME="Misaligned CI" GIT_AUTHOR_EMAIL="ci@misaligned.invalid" \
   bash tools/publish-pages.sh "$REV" dist "$REMOTE" || status=$?
 # 2 means a newer commit is on main; its own run will publish.
-[ "$status" -eq 0 ] || [ "$status" -eq 2 ] || exit "$status"
+[ "$status" -eq 0 ] || [ "$status" -eq 2 ] || { echo "publish: FAILED (publish-pages.sh exited $status)" >&2; exit "$status"; }